SetupProtocol:XML

Security

Thinq1 devices have a very weak security model. They use TLS encryption for communications, but will accept any TLS certificate without verification. The setup procedure is required only to configure Wi-Fi credentials.

Communications protocol

The modem listens for TLS-encrypted connections on TCP port 5500 just as in the JSON-based variant.

The protocol uses a simple framing format:

• header: 0xAA
• length: 16-bit big-endian
• payload: length bytes
• crc: 16-bit big-endian (crc16-xmodem variant)
• footer: 0xBB

Commands

The payload is xml-formatted, the root element is named "mTosp". The devices accept at least these two kinds of requests:

deviceinfo

Request:

<mTosp><data type="deviceinfo"><time>1774208642550</time><reg>000</reg><errorCode>N</errorCode></data></mTosp>

The time value is a millisecond-based unix-epoch timestamp.

Response: (TODO: fill in)

apinfo

Request:

<mTosp><data type="apinfo"><format>B64</format><bssid>SSID</bssid><security>WPA_PSK</security><password>PASSWORD</password><subCountryCode>PL</subCountryCode><regionalCode>eic</regionalCode></data></mTosp>

SSID & PASSWORD are base64-encoded. There is another variant which uses plaintext passwords, but using base64 avoids a whole lot of encoding issues.